Security vulnerability in curl 8.2.1 already patched in Core Update 180

Security
1

Summary

The latest IPFire release uses curl 8.2.1, which contains a high-severity heap buffer overflow vulnerability (CVE-2023-38545) in SOCKS5 proxy handling.

Risk

The bug can lead to unauthorized memory access, posing a potential security risk. It is triggered when using SOCKS5 proxies configured for remote hostname resolution.

Mitigation

Be aware of this vulnerability, if you use SOCKS5 proxies be careful to use the local Unbound for name resolving, at least until a patched version will be available in future versions of IPFire. If I understand the advisory correctly, the vulnerability occurs ONLY when curl is asked to let the SOCKS5 proxy resolve the hostname.

2

Core Update 180 also had the patch fix for that CVE applied to it so Core Update 180 is not vulnerable to that issue.

See the Core Update 180 Release Blog Post
https://blog.ipfire.org/post/ipfire-2-27-core-update-180-released

3 Likes